Data Processing Addendum

1. Scope, roles and duration

This Data Processing Addendum (DPA) identifies SinarTech HR FZ-LLC, a RAKEZ-licensed Free Zone Limited Liability Company (Services Licence No. 47035612), as the HR Copilot service operator. Its licensed address is VUNE2810, Compass Building, Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. Once this DPA is adopted as effective and accepted by the subscribing Customer, it governs Customer Personal Data processed on the Customer's behalf for the subscribed HR features. The Customer is ordinarily controller, or an authorised processor for another controller; HR Copilot is processor or subprocessor accordingly. Statutory roles prevail. The operator confirms that the subscribed HR software service forms part of its licensed Human Resources Consultancy activity.

Documented instructions include the accepted service configuration and authorised user actions, subject to lawful limits. Processing continues only for the service purpose and agreed duration, including lawful return/deletion handling. Separate account, billing, website and security-controller processing is explained in the Privacy Policy.

2. Instructions and confidentiality

Process Customer Personal Data only on documented lawful instructions or as legally required. Notify the Customer where an instruction appears to infringe applicable data-protection law and suspend the affected instruction where necessary. Give prior notice of legally required processing unless prohibited.

Limit access to authorised personnel who need it and are subject to appropriate confidentiality duties. Maintain proportionate access approval, revocation and audit records, including support access. Do not sell Customer Personal Data or use it for unrelated advertising.

3. Security and accountability

Maintain appropriate organisational and technical measures proportionate to risk, including authenticated role/organisation access, transport security, protected secrets and integration tokens, relevant audit records, secure development and incident handling. Measures must be accurately described and reviewed as the service changes.

Existing payroll isolation regressions and backup inventory checks provide limited evidence. They are not certification of every access path, an exhaustive security audit or proof of restoration/document-byte recovery. Those operational reviews remain adoption work; no certification, absolute security or untested recovery guarantee is made.

4. Subprocessors and locations

The provider register identifies service functions and known locations. Before final adoption, the parties must complete provider contracting identities, written data-protection obligations, proportionate diligence, applicable authorisation and change-notice/objection arrangements. Those details cannot be inferred from a provider brand alone.

The final provider-change process must give the Customer the legally required information and a practical opportunity to raise substantiated data-protection concerns before a relevant change, with an appropriate resolution for affected processing. Mandatory regulatory powers and rights prevail. HR Copilot retains the responsibility required by law and the agreed DPA for its service providers.

5. International processing

Use the processing locations and valid transfer safeguards agreed for the relevant activity and regime. Identify the recipient, destination, purpose and applicable contract or other transfer route in the completed transfer record. Assess material location, recipient or onward-transfer changes before introducing them where required.

This DPA is not itself a universal international-transfer mechanism. The Customer’s subscription acceptance is not consent on behalf of every employee or correspondent. Mandatory transfer instruments prevail over conflicting general terms.

6. Rights, assessments and evidence

Promptly route customer-data requests to the Customer, verify authority and assist proportionately with applicable access, correction, deletion, export, objection and restriction duties. Assist with relevant impact assessments, regulator enquiries and security obligations. HR Copilot responds directly for processing for which it is independently responsible.

Provide relevant compliance information, beginning with available reports and written responses. Permit legally required or reasonably justified audits with safeguards for security, other customers and confidentiality. Contractual arrangements must not obstruct mandatory regulator access or statutory audit rights.

7. Personal-data breaches

Notify the Customer without delay upon awareness of a personal-data breach affecting Customer Personal Data and within any shorter legally required period. Initial notice contains the available information and is not postponed solely for a complete investigation. Provide material updates, proportionate containment/remediation and assistance with required reporting.

Each party retains its own direct duties to individuals and authorities. Keep current security contacts and an escalation record. A notification does not itself admit liability. This proposal does not substitute a universal 72-hour deadline for the applicable law.

8. Return, deletion and retention

Provide secure return or deletion on lawful authorised instructions and at the end of processing according to the completed retention schedule. Distinguish live records, document objects, derived/imported copies, provider-held records, legal holds and backups. An authorised export or deletion request can be submitted through info@sinartech.ae after subscription expiry.

Isolate any justified legally retained records and restrict use to that purpose. Protect backup copies awaiting verified expiry and reapply applicable deletions before restoration into ordinary use. Provide reasonable confirmation on request, subject to lawful exceptions. Fixed deadlines remain pending operational verification for this proposal; they are not silently adopted.

Schedule A — processing description

Data subjects: customer employees, managers, HR and portal users, business contacts and people whose information is lawfully included in uploaded records or imported messages.

Data: account/contact identifiers; employment/lifecycle records; compensation/payslips; leave and expenses; customer documents and signature/audit evidence; requests, tasks, policies and knowledge; relevant messages and meeting details. Sensitive information may arise in documents or free text; define its necessity, permitted categories and lawful conditions rather than authorising all sensitive data.

Operations and purpose: hosting, organising, retrieving, role-controlled display, authorised preparation/export, requested notifications, enabled integrations and disclosed AI assistance, to provide, secure and support the subscribed HR features on lawful instructions. Duration: service processing plus completed return/deletion and legal-exception handling.

Schedule B–D and adoption

Security evidence, the provider/transfer register and the retention schedule form supporting schedules. The operator identity, licence number and licensed address are now documented from the RAKEZ licence. The supplier/AI contracting and transfer review, enforceable deletion/recovery commitments and final operational/legal sign-off remain separate release conditions and must not be treated as automatically satisfied by identifying the operator.

This is the verified-operator reference edition, version 2026-10-24-verified-1. It is not an active customer DPA until the applicable release and acceptance checks succeed. Mandatory legal rights remain applicable and the Terms' liability provisions do not remove non-waivable obligations. Existing customers are not deemed to have accepted amended Terms or a DPA retroactively.